--- sourceDocument: Australia Security Management sourceDocumentLink: https://www.servicenow.com/docs/r/security-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia Security Management ft:clusterId : - security bundleId : - security workflow : - Technology --- # Invicti Vulnerability Integration # Invicti Vulnerability Integration {#ariaid-title1} * Release version: Australia * * Updated July 6, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Invicti Vulnerability Integration The Invicti Vulnerability Integration enables ServiceNow customers to import and manage application security scanner data from Invicti within their ServiceNow AI Platform®. This integration supports various scanning techniques---Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), Interactive Application Security Testing (IAST), and Software Composition Analysis (SCA)---to help prioritize and assess vulnerabilities found in your applications. Show full answer Show less This integration directly feeds data into the ServiceNow Application Vulnerability Response feature, allowing you to consolidate and automate vulnerability management workflows. ## Key Features * **Multiple Scan Types Supported:** Imports data from DAST, SAST, IAST, and SCA scanners. * **Integration Versions:** Choose versions compatible with Unified Security Exposure Management (USEM) 30.x and above for enhanced unified vulnerability management, or versions below 30.x for legacy support. * **Chained Scheduled Jobs:** Integrations run in sequence automatically via scheduled jobs to keep your vulnerability data synchronized and up-to-date, with options for manual execution. * **Integration Groupings:** * **Enterprise (Legacy):** Imports application vulnerability data into Discovered Applications or Scanned Applications tables based on configuration. * **Platform:** Provides unified integration of Invicti application vulnerabilities alongside infrastructure vulnerabilities for comprehensive security posture visibility. * **Flexible Application Import Configuration:** You can configure how applications are imported---either linking to product models or configuration items (CIs)---via system properties and lookup rules to align with your asset management practices. * **Detailed Vulnerability Mapping:** Vulnerabilities imported from Invicti include unique type identifiers (e.g., Invicti-DirectoryListing) for clear tracking and management within your instance. ## Practical Use and Benefits * Automates the import and synchronization of Invicti vulnerability scan data, reducing manual effort and improving accuracy. * Helps prioritize remediation by integrating vulnerability findings into ServiceNow's Application Vulnerability Response workflows. * Offers comprehensive vulnerability visibility by combining application vulnerabilities with infrastructure vulnerabilities when using the Platform integration. * Supports scalability and customization through system properties and lookup rules to fit organizational asset management and vulnerability response processes. The Invicti Vulnerability Integration uses application data imported from the Invicti product to help you determine the impact and priority of flaws in your code. ## Invicti Vulnerability Integration {#invicti-vuln-integration__section_zvz_c51_vzb} The Invicti Vulnerability Integration collects scanner data and makes that data available to the ServiceNow AI Platform®. It easily integrates with the ServiceNow® Application Vulnerability Response feature of Vulnerability Response to map imported third-party application vulnerability information into your instance. The integration imports the following types of scanned data. * Dynamic Application Security Testing (DAST) * Static Application Security Testing (SAST) * Interactive Application Security Testing (IAST) * Software Composition Analysis (SCA) {#invicti-vuln-integration__ul_ssr_tw1_vzb} For more information about DAST and IAST, see [Exploring Application Vulnerability Response](https://www.servicenow.com/docs/f_ns8m5SwM0B38fyd4Ck7w "Application vulnerabilities are vulnerabilities on your custom software applications that are scanned throughout the application’s development life cycle."). ## Available versions {#invicti-vuln-integration__section_esm_d51_vzb} {#invicti-vuln-integration__table_fpy_bw1_vzb__entry__2} | Release version | Release notes | |-|-| | If you intend to upgrade to a version that is compatible with Unified Security Exposure Management (USEM), select a version starting with 30.x when installing or upgrading. | [Application Vulnerability Response release notes](https://www.servicenow.com/docs/access?context=secops-app-vuln-resp-rn&version=australia&pubname=australia-release-notes&ft:locale=en-US) For compatibility information, see [KB0856498 Vulnerability Response Compatibility Matrix and Release Schema Changes](https://support.servicenow.com/kb_view.do?sysparm_article=KB0856498) | | If you don't intend to upgrade to a version that is compatible with Unified Security Exposure Management (USEM), select a version number below 30.x when installing or upgrading. | | [ ] {#invicti-vuln-integration__table_fpy_bw1_vzb} ## Integrations {#invicti-vuln-integration__section_dq3_351_vzb} The following integrations are included in the base system. The integrations are chained so that after one integration successfully completes, the next integration is initiated. The integrations run in the order listed in the following table. After the initial run, every day, scheduled jobs are chained to run these integrations automatically in order. You can also execute individual scheduled jobs manually. Scheduled jobs simplify the vulnerability remediation life cycle by keeping the instance synchronized with other vulnerability management systems. Starting with version v30.2 (Unified Security Exposure Management (USEM)) and v2.0 (non-Unified Security Exposure Management (USEM)), the integrations are grouped under Enterprise and Platform types. All the integrations are compatible with legacy (non-Unified Security Exposure Management (USEM)) and Unified Security Exposure Management (USEM). * Enterprise - Legacy integrations import DAST, SAST, IAST, and SCA scanned data. * Platform - Integrate application vulnerabilities from Invicti for DAST, SAST, IAST, and SCA into a unified platform alongside infrastructure vulnerabilities, providing you with a comprehensive view of your security posture. The Platform Integrations are chained like the Enterprise integrations where the next integration in the chain runs after the successful completion of the proceeding integration. The sequence starts with the Application List integration, but the run type is on_demand.{#invicti-vuln-integration__section_dq3_351_vzb__entry__2} | Integration | Description | |-|-| | Application List | Initiate this integration on-demand. Imports the list of applications being scanned in Invicti Platform into your ServiceNow AI Platform® instance as discovered applications. | | Scan Summary | If configured and activated, this integration is initiated automatically after the Application List Integration is successfully completed. Pulls scan records from Invicti Platform, providing scan metadata to correlate with vulnerability findings. Updates existing records or creates new ones. | | Findings | If configured and activated, this integration is initiated after the Scan Summary Integration is successfully completed. Imports application vulnerability findings from Invicti Platform and creates or updates application vulnerable items in Vulnerability Response in your ServiceNow AI Platform®. | [Table 1. Platform Invicti Vulnerability Integration integrations] {#invicti-vuln-integration__table_ezq_lw1_vzb__entry__2} | Integration | Description | |-|-| | Invicti Application List Application | Imports applications scanned by Invicti into the Discovered Applications \[sn_vul_app_release\] table or the Scanned Application \[sn_vul_app_scanned_application\] table based on how the sn_vul.use_product_model system property is set for the configuration item (CI) lookup rule records. * If the product model property is set to true, an application is inserted in the Discovered Application release table. It links to a product model using product model lookup rules. If a model is not found, a model is created: a software model if a version is present in the import, and an application model if it's version agnostic. * If the product model property is set to false, it links to a CI via lookup rules. If lookup rules fail, then a Scanned Application record is created and inserted in the Scanned Application table. {#invicti-vuln-integration__ul_rdz_qys_d1c} You can choose to activate lookup rules with configuration items (CIs) as the lookup targets by modifying the system property. If you modify it, you should also activate CI Lookup rules to match the lookup target. For more information, see: * [Configure the Invicti Vulnerability Integration](https://www.servicenow.com/docs/bXccrWLlcwmVs~BCf0aM8A "Before you run the integration on your instance, the installation and configuration steps must be completed so the Invicti Vulnerability Integration properly works with the Application Vulnerability Response feature of Vulnerability Response.") * [Create a CI lookup rule](https://www.servicenow.com/docs/cYesQhAYuo9aAtGPm342qA "The CI Lookup Rules module contains rules that define what fields have matching data in the Configuration Management Database (CMDB). These rules are used to identify applications and application releases and add them to the application vulnerable item (AVI) record to aid in remediation.") * [Reapplying lookup rules in Application Vulnerability Response](https://www.servicenow.com/docs/ZuoGc27187dD~zpQWY9fkQ "You can reapply your configuration item (CI) lookup rules to update existing CIs (scanned applications and product models) on discovered application records.") {#invicti-vuln-integration__ul_zhk_klt_d1c} | | Invicti Scan List Integration | This integration is initiated after the Application List Integration is successfully completed. This integration imports data about the date and time a scan was run. | | Invicti Application Vulnerable Item Integration | This integration is initiated after the Scan List Integration is successfully completed. View details such as total processing times, average times for pre- and post-integration run processes, and reports on the integration run records for the Application Vulnerable Item integration. Each vulnerability in Invicti has a type, for example,DirectoryListing. This type is mapped as a unique ID in your instance and displayed as part of the value in the Vulnerability field on the application vulnerable item (AVI) record: Invicti-DirectoryListing. For more information about mapping, see [Invicti Vulnerability Integration state mapping](https://www.servicenow.com/docs/oa1mTkUw6D1Lqd6F9r398g "The following source states from the Invicti Vulnerability Integration and their target states in your instance are listed in the following table."). | [Table 2. Enterprise Invicti application vulnerability integrations] {#invicti-vuln-integration__table_ezq_lw1_vzb} The upper limit for items per page for all three integrations is 200.